Create workflow to trigger email if any specific business role(empty role) from list is assigned or revoked from user

SailPoint Human Fabric (SHF) SHF Discussion and Questions
, , , ,
1

Hi Experts,

We have requirement to create a new workflow to send an email if a specific business role(its an empty role i.e no actual provisioning/deprovisioning) is assigned or revoked to an identity.

Am struggling to start with trigger that I need to choose.

Any suggestions would be great :slight_smile:

Regards,

Bhushan Dhodi

2

Here is what I would do:

  1. Create an Identity Attribute: say “workflowTrigger”
  2. Use attached Transform to set the value for this attribute
  3. Workflow to trigger when the value of this attribute changes

Test_GetAssignedRoles.json (744 Bytes)

Now you can assign/revoke the specific role (“GetAssignedRulesTest” in my example) and the identity attribute will change in next calculation.

Note that workflow will not be triggered immediately when role is assigned/revoked

3

@bhushan008 you can follow this if it works for you

  1. Start from the access-item lifecycle event trigger that fires when access is assigned or revoked.
  2. Fetch the identity from the trigger so the workflow can include stable identity details in the email body.
  3. Validate the event represents a role, not an entitlement or access profile.
  4. Because the current requirement says “any role”, do not add a target-role ID filter. If you later narrow this to one role, add a role-ID choice step here.
  5. Branch on operation:
    • assignment path sends an “assigned” email
    • revoke path sends a “revoked” email
  6. Use the tenant’s native workflow email action to send the email to owner
  7. Keep the recipient and template structure the same across both paths, changing only the subject/body language for assign vs revoke.
  8. End successfully after either email path. Non-role events should exit as no-op success.
  9. Route workflow email failures to a single failure step.
4

Hi @bhushan008 ,

One approach you could try is using a metadata-driven solution. For all the empty/business roles that require an email notification, add a role metadata attribute such as genericEmailRequired: Yes.

Then, depending on your requirement:

  • Use the Provisioning Completed workflow trigger if you want the email to be sent only after the role assignment/removal has been successfully processed.
  • Or use the Access Request Submitted trigger if you want the notification to be sent immediately after the request is submitted.

Within the trigger payload, you can identify the processed role(s). Then use an HTTP Request action to retrieve the role details via the SailPoint Roles API and read the value of the genericEmailRequired metadata attribute. If the value is Yes, send the email; otherwise, simply exit the workflow without sending anything.

This approach keeps the workflow generic and avoids hardcoding role names. You only need to maintain the metadata on the roles that require email notifications.

5

Hi @schattopadhy ,

I do not see access-item lifecycle event trigger in Identity security cloud.

Regards,

Bhushan Dhodi

6 
{
  "name": "Business Role Assignment Notification",
  "description": "Sends email to role owner when a business role is assigned or revoked via access request",
  "definition": {
    "start": "Check Request Type",
    "steps": {
      "Check Request Type": {
        "type": "decision",
        "condition": {
          "and": [
            {
              "source": "$.accessRequest.requestType",
              "equals": "ROLE_REQUEST"
            },
            {
              "source": "$.accessRequest.status",
              "equals": "COMPLETE"
            }
          ]
        },
        "onTrue": "Extract Role Changes",
        "onFalse": "Exit Success"
      },
      "Extract Role Changes": {
        "type": "action",
        "actionType": "evaluateExpression",
        "expression": {
          "roleAdds": "$.accessRequest.requestedItems[?(@.type == 'ROLE' && @.operation == 'Add')]",
          "roleRemoves": "$.accessRequest.requestedItems[?(@.type == 'ROLE' && @.operation == 'Remove')]"
        },
        "nextStep": "Branch on Operation"
      },
      "Branch on Operation": {
        "type": "decision",
        "condition": {
          "source": "$.roleAdds",
          "greater": 0
        },
        "onTrue": "Process Role Assignment",
        "onFalse": "Check Role Revocation"
      },
      "Process Role Assignment": {
        "type": "loop",
        "itemExpression": "$.roleAdds",
        "variable": "currentRole",
        "steps": [
          "Get Role Owner",
          "Send Assignment Email"
        ],
        "nextStep": "Exit Success"
      },
      "Get Role Owner": {
        "type": "action",
        "actionType": "requestApi",
        "method": "GET",
        "url": "https://{tenant}.identitynow.com/api/v2/roles/{currentRole.id}",
        "headers": {
          "Authorization": "Bearer {accessToken}"
        },
        "responsePath": "$.owner",
        "output": "roleOwner",
        "nextStep": "Send Assignment Email"
      },
      "Send Assignment Email": {
        "type": "action",
        "actionType": "sendEmail",
        "to": "$.roleOwner.email",
        "subject": "Role Assigned: {currentRole.name}",
        "body": "A business role has been assigned.\n\nRole: {currentRole.name}\nIdentity: {$.identity.name}\nEmail: {$.identity.email}\n\nPlease review if needed.\n\nTimestamp: {$.requestedDate}",
        "nextStep": null
      },
      "Check Role Revocation": {
        "type": "decision",
        "condition": {
          "source": "$.roleRemoves",
          "greater": 0
        },
        "onTrue": "Process Role Revocation",
        "onFalse": "Exit Success"
      },
      "Process Role Revocation": {
        "type": "loop",
        "itemExpression": "$.roleRemoves",
        "variable": "currentRole",
        "steps": [
          "Get Role Owner for Revoke",
          "Send Revocation Email"
        ],
        "nextStep": "Exit Success"
      },
      "Get Role Owner for Revoke": {
        "type": "action",
        "actionType": "requestApi",
        "method": "GET",
        "url": "https://{tenant}.identitynow.com/api/v2/roles/{currentRole.id}",
        "headers": {
          "Authorization": "Bearer {accessToken}"
        },
        "responsePath": "$.owner",
        "output": "roleOwner",
        "nextStep": "Send Revocation Email"
      },
      "Send Revocation Email": {
        "type": "action",
        "actionType": "sendEmail",
        "to": "$.roleOwner.email",
        "subject": "Role Revoked: {currentRole.name}",
        "body": "A business role has been revoked.\n\nRole: {currentRole.name}\nIdentity: {$.identity.name}\nEmail: {$.identity.email}\n\nPlease review if needed.\n\nTimestamp: {$.requestedDate}",
        "nextStep": null
      },
      "Exit Success": {
        "type": "exit",
        "status": "SUCCESS"
      }
    }
  },
  "trigger": {
    "type": "EVENT",
    "event": "ACCESS_REQUEST_COMPLETED"
  },
  "owner": {
    "type": "IDENTITY",
    "displayName": "Workflow Owner"
  }
}
7

@bhushan008

You can use the Identity Attributes Changed trigger if the business role assignment is reflected in an identity attribute.

However, the most reliable approach is usually to use the Access Request Completed trigger (for role assignments through requests) or Identity Attribute Changed trigger (if role membership is managed automatically).

In the workflow:

  1. Trigger when the role is assigned or removed.
  2. Check whether the role name matches your specific business role.
  3. Determine whether the action is Add or Remove.
  4. Send the appropriate email notification.

If the role is assigned through multiple mechanisms (access requests, lifecycle events, certifications, automated workflows, etc.), consider monitoring the identity’s assigned roles via a trigger and filter specifically for that role name. This ensures notifications are sent regardless of how the role assignment occurred.